Method for organizing large numbers of documents

ABSTRACT

A computer product including a data structure for organizing of a plurality of documents, and capable of being utilized by a processor for manipulating data of the data structure and capable of displaying selected data on a display unit. The data structure includes a plurality of directionally interlinked nodes, each node being associated with one or more documents having a header and body text. All the documents are associated with a given node and have identical normalized body text. All documents that have identical normalized body text are associated with the same node. One or more of the nodes is associated with more than one document. For any node that is a descendent of another node, the normalized body text of each document associated with the node is inclusive of the normalized body text of a document that is associated with the other node.

CROSS-REFERENCE TO RELATED APPLICATIONS

This is a Continuation of U.S. application Ser. No. 12/839,976 filedJul. 20, 2010, which is a divisional of U.S. application Ser. No.11/968,433, filed Jan. 2, 2008, which claims the benefit of U.S.Provisional Application No. 60/974,974 filed Sep. 25, 2007 and U.S.Provisional Application No. 60/947,606 filed Jul. 2, 2007. Thedisclosure of the prior applications is hereby incorporated by referenceherein in its entirety.

FIELD OF THE INVENTION

The present invention relates to the field of organizing large numbersof documents.

BACKGROUND OF THE INVENTION

In litigation proceedings, as well as for other functions, often massiveamounts of documents must be reviewed. Certain organizational methodsfor arranging documents exist in the art. Emails are a particular typeof document that are useful to review in structures, to help make senseof the proceedings and reduce the number of documents that need to beread.

The need to detect near duplicate documents arises in many applications.Typically this may occur in litigation proceedings. In litigation, oftenone of the parties initiates discovery proceedings which force the rivalparty to reveal all the documents at his disposal that pertain to thelegal dispute. In order to meet the provisions of the discoveryprocedure, the disclosing party hands piles of documents, sometimes inorder to duly meet the full disclosure stipulations, or in certain othercases, as a tactical measure to flood the other party with huge amountsof documents, thereby incurring the receiving party considerable legalexpenses in the tedious task of determining which documents are relevantto the dispute under consideration. In many cases, out of the repertoireof disclosed documents, many are similar to each other. A preliminaryknowledge which will group and/or flag documents that are similar to oneanother would streamline the screening process, since for example, if acertain document is classified as irrelevant, then probably all thedocuments that are similar thereto, are also deemed irrelevant. Thereare numerous other applications for determining near duplicatedocuments, sometimes from among a very large archive of documents(possibly of the order of millions of documents or more).

A common type of document that is examined in litigation procedures isemails. If collected from user accounts of various users in a company,there is likely to be a degree of duplicity between users. Duplicity mayoccur because the same email is sent to a number of recipients at once,or for other reasons. Also, many times, emails are near duplicates ofone another.

LIST OF RELATED ART

U.S. Pat. No. 7,035,876 to Kawai et al provides a system and method forevaluating a structured message store for message redundancy. A headerand a message body are extracted from each of a plurality of messagesmaintained in a structured message store. A substantially unique hashcode is calculated over at least part of the header and over the messagebody of each message. The messages are grouped by the hash codes. Onesuch message is identified as a unique message within each group. In afurther embodiment, the messages are grouped by conversation thread. Themessage body for each message within each conversation thread group iscompared. At least one such message within each conversation threadgroup is identified as a unique message. The invention requires that allemails in a set have the same subject line. Additionally, all emailsmust have the same attachment to be considered part of the same set.

U.S. Pat. No. 6,119,124: Method for clustering closely resembling dataobjects. A computer-implemented method determines the resemblance ofdata objects such as Web pages. Each data object is partitioned into asequence of tokens. The tokens are grouped into overlapping sets of thetokens to form shingles. Each shingle is represented by a uniqueidentification element encoded as a fingerprint. A minimum element fromeach of the images of the set of fingerprints associated with a documentunder each of a plurality of pseudo random permutations of the set ofall fingerprints, are selected to generate a sketch of each data object.The sketches characterize the resemblance of the data objects. Thesketches can be further partitioned into a plurality of groups. Eachgroup is fingerprinted to form a feature. Data objects that share morethan a certain numbers of features are estimated to be nearly identical.

U.S. Pat. No. 6,189,002: Process and system for retrieval of documentsusing context-relevant semantic profiles. A process and system fordatabase storage and retrieval are described along with methods forobtaining semantic profiles from a training text corpus, i.e., text ofknown relevance, a method for using the training to guidecontext-relevant document retrieval, and a method for limiting the rangeof documents that need to be searched after a query. A neural network isused to extract semantic profiles from text corpus. A new set ofdocuments, such as World Wide Web pages obtained from the Internet, isthen submitted for processing to the same neural network, which computesa semantic profile representation for these pages using the semanticrelations learned from profiling the training documents. These semanticprofiles are then organized into clusters in order to minimize the timerequired to answer a query. When a user queries the database, i.e., theset of documents, his or her query is similarly transformed into asemantic profile and compared with the semantic profiles of each clusterof documents. The query profile is then compared with each of thedocuments in that cluster. Documents with the closest weighted match tothe query are returned as search results.

U.S. Pat. No. 6,230,155: Method for determining the resemblance ofdocuments. Disclosed is a method for facilitating the comparison of twocomputerized documents. The method includes loading a first documentinto a random access memory (RAM), loading a second document into theRAM, reducing the first document into a first sequence of tokens,reducing the second document into a second sequence of tokens,converting the first set of tokens to a first (multi)set of shingles,converting the second set of tokens to a second (multi)set of shingles,determining a first sketch of the first (multi)set of shingles,determining a second sketch of the second (multi)set of shingles, andcomparing the first sketch and the second sketch. The sketches have afixed size, independent of the size of the documents. The resemblance oftwo documents is provided, using a sketch of each document. The sketchesmay be computed fairly fast and given two sketches, the resemblance ofthe corresponding documents can be computed in linear time in the sizeof the sketches.

U.S. Pat. No. 6,240,409: Method and apparatus for detecting andsummarizing document similarity within large document sets. A method andapparatus are disclosed for comparing an input or query file to a set offiles to detect similarities and formatting the output comparison dataare described. An input query file that can be segmented into multiplequery file substrings is received. A query file substring is selectedand used to search a storage area containing multiple ordered filesubstrings that were taken from previously analyzed files. If theselected query file substring matches any of the multiple ordered filesubstrings, match data relating to the match between the selected queryfile substring and the matching ordered file substring is stored in atemporary file. The matching ordered file substring and another orderedfile substring are joined if the matching ordered file substring and thesecond ordered file substring are in a particular sequence and if theselected query file substring and a second query file substring are inthe same particular sequence. If the matching ordered file substring andthe second query file substring match, a coalesced matching orderedsubstring and a coalesced query file substring are formed that can beused to format output comparison data.

U.S. Pat. No. 6,349,296: Method for clustering closely resembling dataobjects. A computer-implemented method determines the resemblance ofdata objects such as Web pages. Each data object is partitioned into asequence of tokens. The tokens are grouped into overlapping sets of thetokens to form shingles. Each shingle is represented by a uniqueidentification element encoded as a fingerprint. A minimum element fromeach of the images of the set of fingerprints associated with a documentunder each of a plurality of pseudo random permutations of the set ofall fingerprints, are selected to generate a sketch of each data object.The sketches characterize the resemblance of the data objects. Thesketches can be further partitioned into a plurality of groups. Eachgroup is fingerprinted to form a feature. Data objects that share morethan a certain numbers of features are estimated to be nearly identical.

U.S. Pat. No. 6,658,423: Detecting duplicate and near-duplicate files.Disclosed is an improved duplicate and near-duplicate detection.Techniques may assign a number of fingerprints to a given document by(i) extracting parts from the document, (ii) assigning the extractedparts to one or more of a predetermined number of lists, and (iii)generating a fingerprint from each of the populated lists. Two documentsmay be considered to be near-duplicates if any one of their respectivefingerprints match.

U.S. Pat. No. 6,654,739: Lightweight document clustering is a procedurefor clustering documents that operates in high dimensions, processestens of thousands of documents and groups them into several thousandclusters or, by varying a single parameter, into a few dozen clusters.The procedure is specified in two parts: computing a similarity scorerepresenting the k most similar documents (typically the top ten) foreach document in the collection, and grouping the documents intoclusters using the similar scores.

U.S. Pat. No. 6,751,628: Process and system for sparse vector and matrixrepresentation of document indexing and retrieval. Disclosed is a newdata structure and algorithms which offer at least equal performance incommon sparse matrix tasks, and improved performance in many. This isapplied to a word-document index to produce fast build and query timesfor document retrieval.

U.S. Pat. No. 7,139,756: System and method for detecting duplicate andsimilar documents. A system and a method are described for rapidlydetermining document similarity among a set of documents, such as a setof documents obtained from an information retrieval (IR) system. Aranked list of the most important terms in each document is obtainedusing a phrase recognizer system. The list is stored in a database andis used to compute document similarity with a simple database query. Ifthe number of terms found to not be contained in both documents is lessthan some predetermined threshold compared to the total number of termsin the document, these documents are determined to be very similar. Itis shown that these techniques may be employed to accurately recognizethat documents, that have been revised to contain parts of otherdocuments, are still closely related to the original document. Theseteachings further provide for the computation of a document signaturethat can then be used to make a rapid comparison between documents thatare likely to be identical.

Abdur Chowdhury Duplicate Data Detection The algorithm is based on IDFof the tokens. The algorithm steps are: 1. Get document. 2. Parsedocument into a token steam, removing format tags. 3. Using termthresholds (idf), retain only significant tokens. 4. Insert relevanttokens into Unicode ascending ordered tree of unique tokens. 5. Loopthrough token tree and add each unique token to the SHA1 (1995) digest.Upon completion of token tree loop, a (doc_id, SHA1 Digest) tuple isdefined. 6. The tuple (doc_id, SHA1 Digest) is inserted into the storagedata structure based on SHA1 Digest key. 7. If there is a collision ofdigest values, then the documents are similar. Conrad et. Al: In aseries of a few papers, they describe a method that is based on the IDFmeasure of tokens, and the size of the documents. They are also provideda method of selecting the corpus to evaluate the IDF of a token.

There is thus a need in the art to provide for a new system and methodfor determining near duplicate objects. There is still further need inthe art to provide for a new system and method for determining nearduplicate documents.

SUMMARY OF THE INVENTION

The present invention relates to the organization and display of data,particularly when the source of the data is a huge number of documents.

According to an aspect of the invention, there is provided a computerproduct including a data structure for organizing of a plurality ofdocuments, and capable of being utilized by a processor for manipulatingdata of the data structure and capable of displaying selected data on adisplay unit. The data structure comprises:

a) a plurality of directionally interlinked nodes, each node beingassociated with at least one document having at least a header and bodytext; and wherein all documents associated with a given node havingsubstantially identical normalized body text, and wherein all documentshaving substantially identical normalized body text being associatedwith the same node, and wherein at least one node being associated withmore than one document;

b) for any first node of the nodes that is a descendent of a second nodeof the nodes, the normalized body text of each document associated withthe first node is substantially inclusive of the normalized body text ofeach document that is associated with the second node.

According to a further embodiment of the invention, all documentsassociated with a given node further have substantially identicalnormalized subject parameter in the header.

According to a further embodiment of the invention, there is providedthat the body text of each document associated with said first node issubstantially inclusive of the body text of each document that isassociated with said second node, irrespective of whether a normalizedsubject parameter from a header of a document associated with said firstnode and a normalized subject parameter from a header of a documentassociated with said second nodes are identical.

According to another aspect of the invention, there is provided a methodfor organizing documents into nodes, in which a node represents a groupof substantially equivalent documents. The method comprises:

(i) providing a plurality of original documents, each comprising aheader and a body, and wherein the header comprises at least oneparameter and wherein the body comprises text,

(ii) selecting a document from among the documents and associating thedocument with a node, comparing at least a portion of the body text ofthe document to at least a portion of the body texts of other documentsfrom amongst the plurality of documents, and in the case of a match,merging the node associated with the document with a node associatedwith the matching document,

(iii) searching the body of the document to locate a first instance ofheader-type text, wherein the header-type text contains at least oneheader parameter;

(iv) constructing a presumed document comprising a header and a body,wherein the header of the presumed document comprises one or moreparameters from the header-type text located within the body of theoriginal document, and wherein the body of the presumed documentsubstantially comprises the text located after the header-type text inthe body of the original document, and associating the presumed documentwith a node;

(v) comparing at least a portion of the body text of the presumeddocument to at least a portion of the body texts of at least one otherdocuments from among the plurality of documents and in the case of amatch, merging a node associated with the presumed document with a nodeassociated with the matching document,

(vi) if the comparison of (v) does not find a match, processingrepeatedly the remainder of the body of the document for successiveinstances of header-type text, as stipulated in stages (iii)-(v), andfor each instance, constructing a presumed document, comparing for anymatching documents to the presumed document, and if found, merging thenodes associated with the matching documents, until no new presumeddocuments are found.

According to another aspect of the invention, a method is provided forreducing duplicate document display of a large number of documents, inwhich the method involves:

a) comparing a fingerprint of a document with previously stored documentfingerprints, wherein a fingerprint is formed for each of at least aportion of the normalized body text and a normalized subject parameterof a document, wherein the comparison for detecting and indicatingduplicating documents;

b) searching the document for instances of header-type text, searchingin text order through the normalized body text of the document, and ifheader-type text is found in the search,

-   -   i) deriving a presumed document comprising a header and a body        text, by treating parameters from the instance of header-type        text in the document as parameters of a header for the presumed        document, and by treating all ensuing body text as the body text        of the presumed document, and applying step a) to the presumed        documents, and    -   ii) if the fingerprint of the presumed document is unique,        continuing to search the normalized body text of the document        from which the presumed document is derived for further        instances of header-type text, searching in text order through        the normalized body text of the document, and if a further        instance of header-type text is found in the search, applying        step i) to derive and process an additional presumed document,        and    -   iii) repeating step ii) until no more instances of header-type        text are found.

In an embodiment of the invention, the method described above alsoinvolves providing a plurality of nodes, and associating each documenthaving a unique fingerprint with a unique node, and associating eachdocument detected as duplicating to a prior document with the nodeassociated with the prior document.

In an embodiment of the invention, the method described above alsoinvolves linking nodes to provide that a node associated with a firstpresumed document becomes the parent of the node associated with thedocument from which the first presumed document is derived, and toprovide that the node associated with each sequentially derived presumeddocument derived from the same document becomes a parent of the nodeassociated with the previously derived presumed document.

In an embodiment of the invention, the method described above alsoinvolves displaying the nodes in a computer format, and affiliating eachnode with the body text and subject parameter of the document associatedwith the node.

According to another aspect of the invention, there is provided acomputer product including a data structure for organizing of aplurality of documents, and capable of being utilized by a processor formanipulating data of the data structure and capable of displayingselected data on a display unit. The data structure comprises one ormore trees, wherein a tree comprises at least a trunk and at least onenode, each node being associated with a document having at least aheader and body text, and wherein a trunk being associated with zero ormore documents having at least a header and a body text and wherein alldocuments whose body text includes the same included document areassociated with the same tree, and wherein a unique inclusive document,as well as documents that duplicate to said unique inclusive document,are associated with one of one or more unique nodes of said tree, andwherein an included document, as well as documents that duplicate tosaid included document, are associated with the trunk of the tree.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to understand the invention and to see how it may be carriedout in practice, an example embodiment will now be described, by way ofnon-limiting example only, with reference to the accompanying drawings,in which:

FIGS. 1a to 1c illustrate an example set of three emails;

FIGS. 2a and 2b illustrate how an inclusive document, such as an email,may be expanded into a set of presumed documents, in accordance with anembodiment of the invention;

FIG. 3 illustrates a first generalized flow diagram of operationalstages in accordance with an embodiment of the invention;

FIGS. 4a-4e illustrate the comparison and storage of fingerprints, inaccordance with an embodiment of the invention;

FIGS. 5a-5c illustrate a second generalized flow diagram, with examplesof operational stages in accordance with an embodiment of the invention;

FIGS. 6a-6c illustrate sample displays showing documents organizedaccording to trees;

FIG. 7 illustrates a sample display of organizational trees arranged asdocument sets;

FIG. 8a illustrates a prior art tree;

FIGS. 8b-8c illustrate two types of trees in accordance with embodimentsof the invention;

FIGS. 8d-8e illustrate output forms in accordance with embodiments ofthe invention; and

FIG. 9 illustrates how the contents of two processors may be arrangedtogether in trees, according to an embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION

It should be noted that the invention is described for convenience, withreference to documents. The term documents is understood to includefiles including text or representing text, such as Microsoft Worddocuments, Excel documents, mail documents, etc. References to documentsembrace also derivative thereof, such as known per se canonicrepresentation of a document. In accordance with certain embodiments,documents include at least text and/or numbers. In one embodiment, thedocuments are Microsoft Office® documents, such as e-mails in selectedformat. The format may be, for example, Microsoft Outlook, Lotus Notes,etc. The term documents is not confined to obvious documents, butapplies also to other types of data objects, such as documents within aZIP file, e-mails in MS Outlook PST file format, attachments, etc.

In the following detailed description, numerous specific details are setforth in order to provide a thorough understanding of the invention.However, it will be understood by those skilled in the art, that thepresent invention may be practiced without these specific details. Inother instances, well-known methods, procedures, components and circuitshave not been described in detail so as not to obscure the presentinvention.

Unless specifically stated otherwise, as apparent from the followingdiscussions, it is appreciated that throughout the specificationdiscussions, utilizing terms such as, “processing”, “comparing”,“linking”, “connecting”, “representing”, “detecting”, “searching”,“deriving”, “calculating”, “storing”, “inserting”, “determining”,“treating”, “repeating”, “identifying”, “labeling”, “indexing”, “runningan algorithm”, “to return, if positive . . . if negative . . . ”,“creating”, “showing”, “displaying”, “suppressing”, “setting levels”,“stringing nodes”, “organizing”, “associating”, “affiliating”, or thelike, refer to the action and/or processes of a computer or computingsystem, or processor or similar electronic computing device, thatmanipulate and/or transform data represented as physical, such aselectronic, quantities within the computing system's registers and/ormemories into other data similarly represented as physical quantitieswithin the computing system's memories, registers or other suchinformation storage, transmission or display devices.

Embodiments of the present invention may use terms such as processor,computer, apparatus, system, sub-system, module, unit and device (insingle or plural form) for performing the operations herein. Devices maybe specially constructed for the desired purposes, or the invention maycomprise a general-purpose computer selectively activated orreconfigured by a computer program stored in the computer. Such acomputer program may be stored in a computer readable storage medium,such as, but is not limited to, any type of disk including floppy disks,optical disks, CD-ROMs, magnetic-optical disks, read-only memories(ROMs), random access memories (RAMs) electrically programmableread-only memories (EPROMs), electrically erasable and programmable readonly memories (EEPROMs), magnetic or optical cards, or any other type ofmedia suitable for storing electronic instructions, and capable of beingcoupled to a computer system bus.

The processes/devices (or counterpart terms specified above) anddisplays presented herein are not inherently related to any particularcomputer or other apparatus. Various general-purpose systems may be usedwith programs in accordance with the teachings herein, or it may proveconvenient to construct a more specialized apparatus to perform thedesired method. The desired structure for a variety of these systemswill appear from the description below. In addition, the presentinvention is not limited to any particular programming language or type.It will be appreciated that a variety of programming languages may beused to implement the teachings of the inventions as described herein.

The following description seeks to explain by way of example whatinclusiveness is, in relation to emails. With reference now to FIGS.1a-1c , a set of three example emails are illustrated. FIG. 1aillustrates a first email. The email includes header 11 and body text21. Header 11 contains metadata for the document, that in this caseincludes To: and From: fields, a date of transmission, and a Subject:field, or “subject” parameter. Parameters from header 11 indicate thatthe email was sent by Andy, to Bill on Sunday. Subject parameters areoften related to body text, in the present email, the subject parameteris the words “Old House”.

FIG. 1b illustrates a second email. The email includes header 12 andbody text 22. Header 12 indicates that the email has been sent as areply to Andy, from Bill, on Monday. Body text 22 includes new text fromBill, some metadata regarding the email of FIG. 1a , and a copy of bodytext 21. Each line of text, from the metadata until the end of theincluded body text 21, is prefaced by a “>” character.

FIG. 1c illustrates a third email. Header 13 indicates that it has beenforwarded by Andy to Charles on Tuesday, with a carbon copy sent toBill. Body text 23 includes new text from Andy, a line stating thatforwarded text is beginning, metadata regarding Bill's forwarded email,and a copy of body text 22.

As has been noted, body text 23 is inclusive of body text 22, which isinclusive of body text 21. Thus, if one wished to read the minimumnumber of texts, one could suffice by reading only body text 23. Ameaning of the term ‘inclusive document’ in the present context isdirected to one document from amongst a group of documents, in which theinclusive one includes the text (or the normalized text) of all theothers. In the set of documents of FIG. 1, FIG. 1c would be consideredthe inclusive document of the three, since its body text 23 includes allthe body text of the other two. Similarly, FIG. 1b can be consideredinclusive of FIG. 1a , since body text 22 includes all the text of bodytext 21.

It will be noted in certain embodiments, when determining inclusiveness,that a first document is only considered inclusive of a second documentif the first document contains within its body text the entire body textof the second document. However, a document can still be consideredinclusive if certain minor differences are present, such as for example,normalization having been applied, or legal disclaimers at the end of anemail having been stripped, or only a certain number of lines orcharacters of the body text are considered as significant.

Having described what inclusiveness represents, with relation to emails,the following describes arrangement of documents, such as emails,according to inclusiveness. In accordance with certain embodiments ofthe present invention, there is provided a method for arranging a largenumber of documents relative to one another. Documents can be any typeof document, but a particular usage of the present invention relates toemails. Documents may be loosely described as including both “body text”and “metadata”. Body text refers to the viewable text of the document,while metadata (also referred to herein as the document “header”)includes information and fields concerning the document, for example thefields for: author, date of creation, subject, date modified, etc. Withregard to emails, which are anticipated to be a particularly usefulbeneficiary of the present invention, a great deal of information isstored as metadata for each email, often including the above fields, andothers, application specific, such as Conversation ID (in MicrosoftOutlook). The header of each email displays some of the metadata for theemail, for example header 11 includes From: and To: fields, as well asDate: (date sent) and Subject: fields.

Emails may very often be inclusive documents. As shown in FIG. 1, it iscommon for people to respond to emails by hitting the reply or forwardbutton at the top of the email program screen. This action prepares forthem a new email, with some or all header fields already filled in, andprovides all the body text of the email being responded to, in the bodyof message. Usually this included body text is preceded by some sort ofheader-type text to indicate what it is. An example of header-type textis shown in FIG. 1b , where the header-type text is:

>Date: Sun, 25 Jul. 2006 15:42:23+0300

>To: Bill@boxmail.com,

>From: Andy Anderson <Andy.anderson@013.com>

>Subject: Old House??

When a few documents from amongst a large number of documents relate tothe same subject matter, it is convenient to have them grouped together.Various organizational techniques are known in the art, such asclassifying documents according to metadata associated with thedocuments, for example according to creation date of the document, orthe author's name, or the subject line. In accordance with certainembodiments of the present invention, there is provided a method forgrouping documents according to included documents.

The method for grouping and arranging documents according toinclusiveness can be applied with at least two different outputs:

1) A set of directionally interlinked nodes are created, in which eachnode is associated with at least one document. Each document has headerparameters and body text, and if more than one document exists with thesubstantially identical body text, all are associated with the samenode. In order to determine if documents are substantially identical,normalization is applied to the text, to remove any irrelevantcharacters. The level of normalization is variable, and no normalizationis also considered normalization, since it represents an equal output toinput. Large degrees of normalization are also possible, as describedbelow. As stated, identical documents are associated with the same node,and, in many cases, many documents will all be associated with the samenode. The nodes are directionally interlinked as follows. A first nodeis arranged or indicated to be a descendant of a second node if the bodytext of each document associated with the first node is substantiallyinclusive of the body text of each document that is associated with thesecond node.

The directionally interlinked nodes can be displayed by a processor on adisplay unit as a representational tree of nodes. The representationaltree shows graphically the relationship between the nodes, indicatingthe degree of inclusiveness that each document associated with the nodeshas relative to the others in the tree. So, in effect, the nodes of thetree graphically display the order of the documents, starting with theshortest one and leading to the longest, most inclusive document.

2) A group of documents that all include a certain document text iscreated. From this group, certain inclusive documents are identified asbeing inclusive of the others. In accordance with certain embodiments ofthe method, there is an advantage in that a reviewer can read all thetext content of the entire group of documents by reading only theidentified documents.

These two outputs are provided for exemplary purposes only, and shouldby no means be considered as limiting the scope of the invention.

In both of the above cases, it is noted that inclusiveness includesinclusiveness of whole documents, wherein a whole document has a headeras well as body text.

However, there are at least three cases in which documents areconsidered inclusive even though the body text of one is not whollyinclusive of the other. Firstly, normalization may have stripped thebody text of part of the text. Secondly, if a first document isinclusive of a document that is near-duplicated to a second document,the first document is considered inclusive of the second document, andthe node associated with the first document is a descendant of thesecond document. Thirdly, it may be desired to use only a portion of thebody text for the purposes of determining inclusiveness. For example,one might want to consider only the first 2000 characters of alldocuments. Other variants besides the specified example are alsoapplicable.

Both of these outputs will be described in more detail with reference toFIGS. 8b -8 c.

A variety of methods may be used in order to group and arrange documentsaccording to inclusiveness; the present disclosure will describe examplemethods, from which other equivalent methods can be extrapolated.

Documents and emails often indicate that other, previous, documents onceexisted. An example of this in FIG. 1b —for even without ever seeingFIG. 1a , FIG. 1a can be derived from FIG. 1b . One embodiment for thepresent invention includes the step of deriving, or reconstitutingpresumed emails from other emails. As mentioned, FIG. 1a can be derivedfrom FIG. 1b , while both FIG. 1a and FIG. 1b can be derived from FIG.1c . When a document such as an email is derived it is termed a“presumed document”—a document that is presumed to have existed due toits incorporation within another document. After a presumed document iscreated, it is then compared with other documents. If the presumeddocument is found to be identical with any other documents, then thedocument from which the presumed document is derived, and the documentto which the presumed document is similar, are identified as belongingto the same group, or tree.

In one manner of implementation of the present invention, each documentthat is to be classified is first provided with identification. Thisidentification is used in accordance with certain embodiments and is notrequired in other embodiments of the present invention; identificationis a method that will be referred to later in this disclosure. Thepresent example is used with reference to emails, but may be used withother types of documents.

A large number of emails are provided, so that they may be organizedaccording to inclusiveness. Each email is first provided with threetypes of identification: an email number, (MailID), an index value(Idx), and an individual, unique document number (DocID). These may beentered into the data structure. The MailID is assigned according to thenumber of emails that have previously been processed, the index value isset at zero, and the DocID is identical to the MailID. The purpose ofthese latter two identifiers will be explained in greater detail below.

Emails, as mentioned, in many cases, are expandable into a set ofpresumed, or derived or secondary documents. With reference now to FIG.2, an email is shown, in terms of general structure, and with email textcontent not shown, for clarity. Email text content may resemble that ofFIG. 1c , for example. The email of FIG. 2 is separately recorded ashaving identification details as follows: MailID is set to X, DocID isset to X, and the index is zero. The email is referred to herein asEmail X₀, in which X is the MailID and ₀ represents the index value. Ina real-life scenario, the letter X would preferably be replaced with anumeric identifier. Email X₀ consists of a header and a body, and theseare labeled as header hX₀ and body text bX₀.

Presumed emails may be derived based on the appearance of header typetext within the body text. For example, Body text bX₀ contains severalinstances of header-type text. Header-type text indicates that all theremaining text in the email, after the header-type text, is likely tohave been originally the body text of an earlier document. Thus apresumed email can be created for each instance of header-type text. Thefirst instance of header-type text indicates a presumed email, and thispresumed email is provided with identification as follows: MailIDremains X, DocID is a numeric string specific to this particularpresumed email, and the index value is 1, implying that this is thefirst presumed email originating from the original email X₀. This first‘presumed document’ is referred to herein as document X₁, and itconsists of header hX₁ and body text bX₁. Body text bX₁ is derived froma copy of all the remaining body text following the header-type textidentified as header hX₁ in document X₀.

The remaining text of body text bX₀, following the header-type textalready located, can still be searched for further instances ofheader-type text, to create further presumed emails. A second instanceof header-type text is found, to suggest a second presumed email, withidentification as follows: MailID remains X, DocID is a numeric stringspecific to this particular presumed email, and the index is 2, implyingthat it is the second presumed email originating from document X₀. Thissecond ‘presumed email is referred to herein as X₂, and includes headerhX₂, composed of the header-type text that caused it. All body text thatfollows header hX₂, namely body text bX₂, forms the body text forpresumed email X₂.

The remaining text of body text bX₀ is also expandable, and a thirdinstance of header-type text can be located. This forms presumed emailX₃, with header hX₃ formed of the header-type text that indicated thepresumed email, and with body text formed of all of body text thatfollows header hX₃, namely body text bX₃.

With reference now to FIG. 2b , Email Y₀ is also expandable intooriginal document Y₀, plus two presumed emails, Y₁ and Y₂. Y₁ consistsof header hY₁, and body text bY₁, while Y₂ consists of header hY₂ andbody text bY₂. Headers hY₁ and hY₂ are composed of header-type textlocated in body text Y₀, in order of appearance respectively. Body textsbY₁ and bY₂ are composed of all of the text of body text Y₀ thatfollowed the header-type texts of headers hY₁ and hY₂ respectively.

As has been shown, it is possible to ‘expand’ an email or other documentinto an email plus a set of presumed emails that were included withinthe body text. The set of presumed emails can then be used forcomparison with other emails to determine which other emails should beconsidered in the same group. However, creating ‘presumed documents’ asdescribed is only one way of implementing the present invention, and theorganization of documents according to inclusiveness may bealternatively implemented in many other ways.

According to certain embodiments of the invention, documents whosecontents have not been derived from within the body text of otherdocuments of the set may be referred to herein as ‘original documents’,this term is relative to ‘presumed documents’ that have been derivedfrom others. ‘Original documents’ however need not be true documentoriginals, for example they may be extracted from bulk files or documentcopies.

Having described ‘presumed documents’ in accordance with certainembodiments, the following seeks to describe the process of preparingfingerprints (for example, CRC, implemented using MD5) of the documents.The fingerprints are prepared for the purpose of comparing original andpresumed documents with other documents from the group of documents. Twodocuments that have the same fingerprints, have with high probabilitythe same content.

In order to determine whether documents should belong to the samegroup—that one is inclusive of the other, or that two are identical toone another, a document comparison may be done. “Matching” and“equivalent” and “duplicating” are other terms that refer herein to twoor more texts that are substantially identical.

According to one embodiment, a copy of each document that has beenprocessed is stored in a repository, and as each new document isprocessed, it is compared with previously stored documents, before beingstored itself. According to one embodiment, the repository is part ofthe data structure, or it may be a separate unit.

One implementation involves the following: the document in its entiretyis not used for the comparison since it may be huge. Instead, only afingerprint of the text of each document is compared. The fingerprint iscreated as follows. A first fingerprint, for example, a CRC (cyclicredundancy check), or for example, CRC-MD5, is compiled for the bodytext or the normalized body text of the document. A subject parameter isdetermined for the document, normalized and a second CRC is compiled forthe normalized subject parameter. If the document is an email, thesubject parameter may be derived from the Header parameter of the fieldlabeled “Subject:”. For example, in FIG. 1a , the subject parameter isthe phrase: “Old House??”. Other types of documents have other types ofsubject parameters, for example, the subject parameter may be a subjectfield filled in by a user when the document is created or modified, orit may be the title or file name or path of the document. It could bethat a document has no subject field, or that the subject parameter isunknown. In accordance with certain embodiments, the subject parameteris a useful field for organizing documents. In accordance with otherembodiments, the subject parameter is not used, for example, the presentinvention allows the subject parameter to be entirely disregarded, ordisregarded only if empty, or alternatively, considered blank if it isunknown.

Fingerprints for the four documents X₀, X₁, X₂ and X₃, of FIG. 2a , arecreated, and are referred to herein as dX₀, dX₁, dX₂ and dX₃respectively. Similarly, fingerprints dY₀, dY₁ and dY₂ are created fordocuments Y₀, Y₁ and Y₂ of FIG. 2b . The term ‘fingerprint’ is intendedto be synonymous with CRC, and sometimes it is used herein to refer tothe combined CRC's of both the body text and the normalized subject,since it is this combination that is preferably used for comparison.This combination, of CRC for the body text with CRC for the normalizedsubject, is also known as the “determiner” for the document.

Having described the compilation of fingerprints for the documents, theprocess of normalization of text is described.

In one embodiment, before creation of the fingerprint, normalization isapplied to the body text and/or subject parameter. The fingerprint wouldthen be compiled from the normalized text. Normalization includes a 1:1ratio, in which the normalization output is equivalent to the input, andsuch normalization is ineffective. In this case, the text may bereferred to as normalized text, even if no normalization function hasbeen applied to it. However, normalization can also remove features thatare not directly part of the body text or subject. For example, for mostdocuments, normalization can be applied to strip all formatting. Thisincludes font, font size, italics, bold, color, etc. For emaildocuments, normalization may also include removing characters that wereadded by the software document creation program. An example of addedcharacters is the “>” sign typically added by email programs when a userreplies to an email. The “>” sign at the beginning of a line indicatesthat that line of text is copied from the email to which the user isreplying. Normalization can also remove headers, footers, attachmentsand attachment notices, disclaimers, and signatures. Another example ofadded characters is in the subject parameter of headers. When replyingto emails, email programs typically add to the subject line thecharacters “Re:”, and when forwarding, they add the characters “Fw:” or“Fwd:”. Other characters that are sometimes added to the body text, byemail programs include “=20”, added when incorrectly converting fromcertain email programs to others. Sometimes a vertical line is added onthe left to indicate included text from a previous email. Superfluousspaces are sometimes added, tabs, new line, etc. For the purpose ofcomparison between documents, normalization is applied to the body textand/or subject parameter. However, the original body text and subjectparameter text is also preserved.

According to certain embodiments, the presence of signatures,disclaimers, anti-virus lines, free mail program notification (programadded text), and attachment notification, can result in the lack ofdetection of true duplicates. For example, two emails may seem differentonly because they contain different disclaimers.

Alternatively, two emails may seem to be near-duplicates, when reallythey are very different, but they contain the same long disclaimer. Ithas been described above that these parameters may be removed in thenormalization process. According to certain embodiments, a furthercategory of normalization is described here. Disclaimers and the likeare stripped from the document, and are replaced with a single word ornumber, unique to each type of disclaimer, signature, etc. This actionreduces the influence of a long disclaimer on the rest of the text. Thustwo emails whose main texts are not near duplicates will not suddenlyappear as near-duplicates due to having identical disclaimers. Yet alsotwo emails that have identical texts with different disclaimers, arerelated but are not true duplicates, so the presence of the replacementword ensures that the text analysis categorizes them as near-duplicates.According to one embodiment of a method for applying the invention, themethod includes removing each of disclaimers, signatures, program addedtext and attachment notifications from the body text of documents, andreplacing each unique disclaimer, signature, program added text andattachment notification with a unique short identifier prior to thecreation of the document fingerprint.

In accordance with certain embodiments, there is provided a sequence ofoperations using normalized fingerprints, to determine equivalence andinclusiveness of documents. The embodiment should not be construed aslimiting the invention in any way, as a number of alternativeembodiments also exist. For example, other means can be implemented toassign values, or the entire system may use Object Oriented Programminginstead of a data structure or database, etc. Data structure details canbe organized differently, and may be organized in terms of trees insteadof in terms of documents, as described herein. A non-limiting form ofdata structure is an SQL database, however, the invention does not needto use a data structure in any way. Hence, the following embodimentshould not be construed as limiting, but is provided for exemplarypurposes only.

Equivalence and inclusiveness may be alternatively accomplished by anindividual algorithm, or another method may be used entirely to achievethe intent of the present invention. In one example, all documents canbe first expanded into all of their component presumed documents, beforecomparison. Or, in another example, only the most inclusive documentsare identified. Or, in a further example, selected documents fromamongst a large group are processed. These selected documents may referto all of the documents, or a defined subgroup from amongst thedocuments. Yet the following is a suggested embodiment. It is assumedthat the document presented for processing has not yet been searched forheader-type text, nor has any normalization yet been applied, nor havefingerprints been created.

The following is a specific example that serves to illustrate a broaderconcept. The specific example involves certain details that onlyrepresent one embodiment of the present invention, and is provided forexemplary purposes only. In accordance with certain embodiments of theinvention, a processor is used with associated display, forcommunicating with the data structure. The processor is capable ofmanipulating the data of the data structure and displaying selected dataon a display unit. With reference to FIG. 3, a document is presented forprocessing. In the present example, the document involved is an e-mail.

In step 301, the document is assigned a DocID value, and an index ofzero. For example, the document may be assigned a DocID of 100.

In step 302, a field is set up for the document being processed,entitled MailID. This is initialized as the DocID of the document.

In step 303, the three identifiers described for the document are storedin a data structure, for example, for a first document, the particularsmight be as follows:

DocID MailID Index 100 100 0

In preliminary step 304 a, fields from the e-mail metadata areconsidered header fields. These include, but are not limited to thefollowing fields: To, CC, BCC, Sent time, Internet Message ID, In ReplyMessage ID, Subject.

In step 304 b, the abovementioned fields from the e-mail header areparsed, including the fields: From, To, CC, BCC, Sent time, InternetMessage ID, In Reply Message ID, Subject, Body, attachments. The parsedinformation is stored in a data structure.

In step 305, the Subject parameter is normalized and a CRC-MD5 iscomputed on the normalized subject (Nsubject). Both the subject and theCRC of the normalized subject are stored.

In step 306, a CRC on the normalized body text (Nbody) is calculated.

In step 307, the normalized body CRC and normalized subject CRC arecompared with others in a repository for CRCs, and if a matching CRCpair already exists in the repository, the DocID of this document islinked to that of the match, and the document is finished beingprocessed.

Otherwise, step 308, a loop, is accessed. This loop enables multiplepresumed e-mails, from the body text of the original email, to belocated, indexed, and processed. In step 308 a, the body text of theoriginal email is searched to locate the next presumed email. In step308 b, if a presumed email is found, the presumed email is provided withidentification, and its index is set to one greater than that of thepreviously processed presumed email. In step 308 c, one is directed tofollow again all the steps to process repeatedly the remainder of thebody of the email for successive instances of header-type text, asstipulated in steps 303 onwards; for each instance, to construct apresumed document, index it, create a CRC pair, compare it for matchingdocuments, and link if found. In step 308 d, when no more presumedemails can be located within the body text of the original email, thedocument is finished being processed.

The following table shows the index value that has been assigned to eachof three presumed documents that are derived from the original documentwith DocID of 100.

DocID MailID Index 100 100 0 110 100 1 120 100 2 130 100 3

Note that each document can be derived from the document of next lowestindex value. For example, document 110 can be derived from 100 (asindeed it was), and document 120 from 110. Therefore document 100 isinclusive of document 110, and document 110 is inclusive of document120. Each document is inclusive of the document of the next index value.Additionally, document 100 is inclusive of all documents that areequivalent to document 110. Inclusiveness of documents and equivalentdocuments is described with reference to FIG. 5.

The following representation details the comparison of documents forequivalence, and also details the construction and comparison ofpresumed documents, the latter being similar to the above descriptionwith reference to FIG. 3. This representation is again a narrowdescription of a broader concept, and is provided for exemplary purposesonly.

In the following representation, a number of documents are to becompared with one another for equivalence. The documents involved areoriginal documents X₀ and Y₀ from FIGS. 2a and 2b , as well as anadditional two documents P₀ and Q₀. Fingerprints have been created foreach of the documents, namely dX₀, dY₀, dP₀ and dQ₀ respectively. Noneof the documents have yet been reconstructed to find presumed documentswithin them. With reference now to FIG. 4a , repository 40 is shown. Ascan be seen, a number of fingerprints are waiting to be processed.Fingerprint dX₀ is the first of the four fingerprints to be processed.It is inserted into repository 40 for comparison, and, since noequivalent fingerprints are found, fingerprint dX₀ is then stored inrepository 40.

With reference now to FIG. 4b , the text of document X₀ is then searchedfor presumed documents, and presumed document X₁ is found. FingerprintdX₁ is created for presumed document X₁. Fingerprint dX₁ is theninserted for comparison into repository 40. Fingerprint dX₁ is alsofound to have no equivalents and so it is also stored in repository 40.Document X₀ is then searched again, for further presumed documents, anddocument X₂ is found, for which fingerprint dX₂ is created. FingerprintdX₂ is inserted for comparison into repository 40. Fingerprint dX₂ isalso found to have no equivalents and so it is also stored in repository40. Document X₀ is then searched for further presumed documents, anddocument X₃ is found, for which fingerprint dX₃ is created. FingerprintdX₃ is inserted for comparison into repository 40. Fingerprint dX₃ isalso found to have no equivalents and so it is also stored in repository40. Document X₀ is then searched for further presumed documents and nomore are found.

With reference to FIG. 4c , fingerprint dY₀ is now processed.Fingerprint dY₀ is inserted into repository 40, and compared with allthe previously stored fingerprints. It is found to be identical tofingerprint dX₁. As a result of this, fingerprint dY₀ is not stored, butfingerprint dX₁ is registered as being a fingerprint of dY₀ as well asof dX₁. It is noteworthy that it is not necessary to search document Y₀to find the presumed emails Y₁ and Y₂ that it does in fact include, asshown in FIG. 2b , since document Y₀ has already been found to beequivalent to document X₁, which has already been expanded.

With reference to FIG. 4d , fingerprint dP₀ is processed. It is found tohave no equivalents, so it is stored in repository 40. Document P₀ isthen searched and found to include document P₁, for which a fingerprintdP₁ is created. Fingerprint dP₁ is also inserted into repository 40,found to have no equivalents, and stored. Document P₀ is searched forfurther expansion possibilities and none are discovered.

With reference to FIG. 4e , fingerprint dQ₀ is inserted into repository40, and found to have no equivalents, so it is stored in repository 40.Document Q₀ is then searched and found to include document Q₁, for whicha fingerprint dQ₁ is created. Fingerprint dQ₁ is also inserted intorepository 40, and found to be equivalent to dP₁. Fingerprint dQ₁ istherefore not stored, but fingerprint dX₁ is registered as being afingerprint of dY₀ as well as of dQ₁.

With reference to FIG. 5, a suggested sequence of operations is providedfor building nodes and trees from compared documents. The compareddocuments may have been compared by any of a variety of methods, forexample, as described with reference to the representation of FIG. 4.

The following sequence of operations is presented in FIG. 5a , and anexample set of documents is shown in FIG. 5b , relating to the sequenceof operations. FIG. 5c shows the documents of FIG. 5b arranged into atree after implementing the sequence of operations of FIG. 5a . Withreference now to FIG. 5b , two original documents are shown, namely 100and 200. Each is expanded to produce presumed documents—document 100 isexpanded to produce documents having DocID of 110, 120 and 130respectively, while document 200 is expanded to produce document 210.These document numbers can also be referred to as the documentidentifiers, or DocID. A MailID of the original and all the derivedpresumed documents is set as the DocID of the original document fromwhich they were derived. Thus, for example, the MailID of documents withDocID of 100, 110, 120 and 130, are all 100, as is actually shown in thetable above, with reference to step 308 of FIG. 3.

With reference once again to FIG. 5b , each document is displayed ashaving a normalized body text CRC and a normalized subject CRC. Forexample, for document 100, these are ‘aa1’ and ‘bb1’ respectively. Eachdocument is assigned a document index according to its relationship withthe original document from which it is derived. For example, Document100 has an index of 0, indicating it is an original document, 101 has anindex of 1, etc, as it is the first presumed document located within thebody text of document 100, etc. It will be noted that Document 210 hasthe identical normalized body text CRC and normalized subject CRC todocument 120, namely ‘aa3’ and ‘bb3’, although they are derived fromdifferent original documents. That is why, in FIG. 5c , these twodocuments are associated with the same node of the same tree.

With reference now to FIG. 5a , in step 501, a field is created in thedata structure for each document, entitled NodeID. NodeID represents thenode to which the document is to be mapped in the tree, although it doesnot refer to any specific node in any specific tree. Rather, NodeIDrepresents a value that is the same for all documents that are supposedto be mapped to the same node. All documents that have the samenormalized body text CRC and normalized subject CRC should be affiliatedwith, or associated with, the same node, so they are to be updated tothe same NodeID. The NodeID field (for each document) is initiallycopied from the DocID field of the document. When a document isidentified as having the same normalized body text CRC and normalizedsubject CRC as a prior document, the two nodes are merged, as follows.The NodeID field for one of the documents is updated to the lower valueNodeID between the two documents. Updating to the lower value ensuresthat as documents are added, the NodeID of already updated documentsremained constant. Various documents may end up with the same NodeID.For example, document 210 has the same fingerprint as document 120.Document 120 has the lower DocID (since it was processed before Document210), so the NodeID of document 210 would update to the NodeID of 120,which is a copy of the DocID of document 120. The following tableindicates the DocID and the NodeID of the example documents:

DocID NodeID 100 100 110 110 120 120 130 130 200 200 210 120

When a first presumed document is found within an original document, thefirst presumed document becomes the parent of the original document,because it is assumed to have happened before original document. When asecond presumed document is found, it is assigned to be the parent ofthe first presumed document, since the second presumed document is moreembedded than the first presumed document, and it is therefore assumedto have occurred earlier. The node associated with each sequentiallyderived presumed document (derived from the same document) becomes aparent of the node associated with the previously derived presumeddocument.

The root of a tree is associated with a node that has no parents. Adocument with no parent is an original or presumed document that doesnot include within its text any further presumed documents. In step 502,a field is filled in (for each document), in the data structure,entitled ParentNode. This ParentNodeID indicates which other document isthe adjacent node in the root direction on a tree. The root of the treeis the node associated with least inclusive document of the tree—thedocument presumed to have been the earliest. Initially, ParentNodeID isset for all documents at −1, indicating that the document should beassociated with a node having no parents. However, when a parent node isidentified for a document, the field of ParentNodeID is updated with theNodeID of the parent node. In the example, the ParentNodeID field forDocument 130 is identified as −1. All the other documents take theirParentNodeID according to the document index as reflected in theirNodeID. The following table shows the ParentNodeID for each of theexample documents:

Parent DocID Node 100 110 110 120 120 130 130 −1 200 120 210 130

In step 503, a field is filled in (for each document), entitled TreeID.This field identifies all documents that should belong to the same treewith the same value. Initially, TreeID for all documents is set as acopy of the NodeID field of the document. Beginning with a document thathas a value for ParentNodeID of −1, the TreeID for that document remainsas the NodeID. Descendants, or children, of that parent node, asindicated by their ParentNodeID field, then have their TreeID updated tothat of their parent node. Then, the next generations of children havetheir TreeID updated to that of their parent node. In this way, alldocuments belonging to the same tree have the same node. The followingtable shows the TreeID for each of the example documents:

DocID TreeID 100 130 110 130 120 130 130 130 200 130 210 130

In step 504, a field can be filled in (for all documents) entitled UNIONEQUISET. This field relates to linking trees that are identified asbelonging to document sets, to be displayed together, as will bedescribed with reference to FIG. 7. Document sets are two or more treesthat one chooses to have linked together. For example one may want tolink documents that are near duplicates of one another, or documentsthat appear to be connected due to the sameness of their ConversationIndex (Microsoft Outlook), or In Reply Message ID (Some Unix mailsystems).

It is also possible to merge trees that are indicated as similar by thefield of UNION EQUISET. In a practical example, if a reviewer wishes toview two documents that are near duplicates of one another, together hemay be able to merge the two trees that they are each part of. The twonodes may be placed adjacent to one another, with or without hyperlinks,and the rest of the trees to which they each belong are similarly putadjacent to or merged with each other, as part of the same tree.

In step 505, for documents that have the same TreeID, the lowest valueof NodeID is used as an update value for the TreeID. As mentionedbefore, using the lower value for the update ensures that earlierdocuments do not get updated, and remain with their assigned values. Thefollowing table shows the updated TreeID for each of the exampledocuments:

DocID TreeID 100 100 110 100 120 100 130 100 200 100 210 100

As can be seen from the above table, all the documents have a TreeID of100, and therefore are in the same tree. FIG. 5c shows the documentsarranged in a tree. Each document is associated with, or represented by,a different node, except for 120 and 210, that share a node. The orderof the nodes within the tree follows the fields for ParentNodeID of step502. Root node 33, contains 130, first intermediate node 34 contains 120and 210, from which branches second intermediate node 35 containing 110,and first leaf node 36 containing 200. Second leaf node 37, containing100, branches from second intermediate node 35.

Email messages often contain peripheries, such as disclaimers,signatures, and attachments. In one embodiment of the present invention,these are suppressed prior to creating a fingerprint and comparingfingerprints. However, in another embodiment, they may be included inthe CRC, or a CRC for these may be used as well. In addition, even ifnot used for purposes of document creation, these peripheries may beaffiliated with the node containing the document to which they pertain,for a reviewer to access.

The following description relates to certain embodiments of the presentinvention, in which there is provided a method to arrange theaforementioned documents and presumed documents into groups according totheir degree of inclusiveness, and according to their equivalence withother documents. Generally speaking, the groups are in the form oftrees, as will now be described with reference to FIG. 6. However, theaforementioned documents can alternatively be arranged in the form ofcolumns or lists, or simply individual documents can be selected forperusal, as will be described with reference to FIGS. 8d and 8 e.

With reference to FIG. 6a , the output of the data structure ispresented as a representational tree consisting of connected nodes. Thetree may be a part of the data structure or communicated from the datastructure to another unit, etc. Root node 83 is associated with adocument that has body text that is not inclusive of the body text ofany other document. Each intermediate node 84 is associated with adocument that has body text that includes all the body text of theprevious node, from the root direction. Leaf node 85 is associated withan inclusive document, having body text that includes all the body textfrom the string of nodes between root node 83 and leaf node 85.

By way of example, if the documents of FIG. 1 were arranged in a tree,FIG. 1a would be associated with a root node 83, FIG. 1b with anintermediate node 34, and FIG. 1c , with a leaf node 85. However, it isto be noted, that a tree may consist of only a single node, if thedocument associated with the single node has no included documents. Inthis case, the single node is both the root node and the leaf node.

As shown in FIG. 6a , there may be several branches to the tree. In FIG.6a , the following three sets of nodes each represent a branch: Nodes83, 84, 85, 86, 87, Nodes 83, 84, 85, 88, 89, 90, and Nodes 83, 84, 85,88, 89, 91. Each of the three branches begins with root node 83, andeach culminates in a leaf node 87, 90, 91. Such branching occurs whenseveral different documents are all inclusive of a common body text. Inthe current example, all the three branches include root node 83 andnodes 84 and 85. The documents that are associated with these nodes havebody text that is shared by all of the more inclusive nodes 86-91. Anode that features immediately adjacent to an arbitrary first node, inthe root direction thereof, is termed the parent node of the first node.

The tree is designed to organize the documents into linked nodes. Eachnode is associated with a group of documents that are equivalent, or atleast substantially so (for example, they may have characters that areremoved in the normalization of the subject procedure) Links betweennodes imply that the text of a document associated with a node on theleaf side of the link includes the text of a document associated with anode on the root side of the link. For example, the text of the documentassociated with node 86 includes the text of the document associatedwith node 85.

According to certain embodiments of the present invention, the datastructure is arranged in the form of trees, and a tree is defined as aset of directionally interlinked nodes. Each node is associated with atleast one document, and all documents associated with a given node havesubstantially the same body text. Also, all documents havingsubstantially the same body text are associated with the same node. Thedirectional interlinkage indicates that if a first node is a descendentof a second node, the body text of each document associated with thefirst node is substantially inclusive of the body text of each documentthat is associated with the second node. For example, node 86 is adescendant of node 85, and the document associated with node 86 issubstantially inclusive of the body text of any and all documents thatare associated with node 85. The second node is a parent node of thefirst node. In the example just given, node 85 is termed the parent nodeof node 86.

The root node of a tree (83) is the ultimate parent of the tree, havingno parents itself. In different trees, the root node may have one ormore descendant nodes, (descendants include intermediate and root nodes)or a root may have no descendants. In FIG. 6a , root node 83 has 8descendent nodes (84-91). There may be several generations of descendantnodes, for example both an intermediate node and a leaf node togetherprovide two generations of descendants. In FIG. 6a , there are 5generations of descendant nodes (1st generation: 84, 2nd generation: 85,3rd generation: 86 and 88, the 4th generation: 87 and 89, and 5thgeneration: 90 and 91). Also, there may be several same generationnodes, for example there may two parallel branches of nodes branchingoff a parent node. In FIG. 6a there are several sets of same generationnodes, for example the 3rd generation has two same generation nodes: 86and 88, the 4th generation also has 2 same generation nodes: 87 and 89and the 5th generation has 90 and 91.

With reference now to FIG. 6b , the documents whose fingerprints are inrepository 40 of FIG. 4c , are organized and presented according totrees. Presumed documents are arranged relative to the original documentfrom which they are derived, by being placed in the root direction ofmore inclusive documents. When two documents share a common root, it isimplied that they both contain the body text of the root. Hence, anypresumed document will automatically be placed in the root direction ofthe document from which it is derived.

In one embodiment, presumed documents are ‘put into’ or associated withthe same tree as the original document from which they are derived, theroot node is the smallest presumed document, that is, the last one to bederived from the original document. The other presumed documents arearranged in the root direction (ie, towards the root) according to theirdegree of inclusiveness. As a result, a node is associated with adocument that has all the body text of all the other nodes in thedirection of the root. In addition, documents that are equivalent, thatis, they have the same body text and subject line, as determined by thedocument fingerprints, share a node. In this way, more complex trees canbe created than simply by stringing together trees according to theiroriginal composition within a document. It is to be noted that inanother embodiment, presumed documents are not associated with nodes,they are only used in order to determine the nodes that other documents,that are equivalent to the presumed documents, should be associatedwith. However, in a further embodiment, also presumed documents areassociated with nodes, sometimes forming a ‘missing link’ when nooriginal email is equivalent to them.

In the present example shown in FIG. 6b , there is only one tree,containing four nodes 92-95.

In one embodiment, root node 92 links to, (also termed: “is affiliatedwith” or otherwise displays) the body text and subject line(non-normalized) of document X₃. Root node 92 is also affiliated withcertain header parameters of document X₃, taken from the header ormetadata of the document, and arranged in a table for easy perusal.First intermediate node 93 (adjacent root node 92) contains the bodytext and subject line of document X₂, and is affiliated with headerparameters from document X₂. Second intermediate node 94 contains thebody text and subject line of document Y₀, and is affiliated with headerparameters of both documents Y₀ and X₁. Leaf node 95 contains the bodytext and subject parameter of document X₀ and is affiliated with headerparameters of document X₀. The header parameters may be affiliated bymeans of hyperlinks to the original document, or the header parametersmay be copied into a hyperlinked or otherwise affiliated table.

It will be noted that only two of the nodes are associated with originaldocuments, that is, second intermediate node 94, associated withdocument Y₀, and leaf node 95, associated with document X₀. The factthat a single tree includes nodes associated with two different originaldocuments, namely Y₀ and X₀, indicates to a reviewer that the contentsof the two documents X₀ and Y₀ are related. Since they occur along thesame thread within the tree, the reviewer can see that document X₀contains all of the text of document Y₀ as well as some additionalmatter.

With reference now to FIG. 6c , a third tree is shown, displaying nodesfor the remaining documents whose fingerprints feature in repository 40of FIG. 4e . The tree consists of just three nodes, that is, one rootnode 96 and two leaf nodes 97 and 98. Each leaf node (97 and 98)contains the body text and subject parameter of an original document,namely P₀ and Q₀. Root node 96 contains the body text and subjectparameter of presumed document P₁, and also supplies affiliations toheader parameters of both documents P₁ and Q₁. Thus two originaldocuments are associated with nodes that are connected into a singletree by virtue of their common included presumed document. This singletree indicates to a viewer that the contents of the two documents P₀ andQ₀ includes identical body text, and that they are likely to be relatedto a similar subject matter. Thus such a tree increases a viewer'scomprehension, compared with viewing the documents as isolated events.

In accordance with certain embodiments of the present invention,additional features of a tree and its construction relate to the factthat emails can be linked into a tree even if they have differentsubject parameters from one another. The factors that determine if nodesare joined to form a tree include descent, and equivalence of theassociated document. It is possible for a user to have changed thesubject line of an email in the course of a correspondence. However, ifa more inclusive email exists, this can be expanded into a selection ofpresumed emails, in which the earlier dated ones will have the firstsubject line, and the later dated ones will have the second subjectline. The presence of the more inclusive email indicates that althoughthe subject line has changed, the documents are nevertheless part of asingle conversational thread. The more inclusive email is expanded intoa set of presumed documents that remain indexed together. As a result,the presumed documents—and all the documents that duplicate to them, arejoined into the same tree. Thus, although the subject line of some ofthese documents is one thing, and the subject line of other of thesedocuments is another, they are nevertheless presented on the same tree,as they were part of the same thread, as indicated by the more inclusivedocument's expanded contents.

Another benefit of an embodiment of the tree presentation of documentsis that a reviewer probably does not wish to read through duplicateddocuments twice. He can read just one copy or just the subject and bodytext of a document associated with the node, in response to clicking ona node, if the node is represented on a display as a clickable icon. Orif the node is not a clickable icon, it may give other writtendirections or a different form of affiliation to the document text. Inaddition, the reviewer may still have access via the node to a hyperlinkto metadata of all the original equivalent documents. If the node isassociated with only a presumed document, the node can affiliate tometadata from the presumed documents too (or the node may simply besuppressed from view, as preferred).

In accordance with certain embodiments of the present invention, headerparameters of equivalent documents grouped into a table and accessedfrom the associated node make it particularly easy for a reviewer tocompare header parameters and/or statistics between the different copiesof ostensibly the same document. For example, he may see which copy isrecorded as having been sent first, find out if there are datediscrepancies (perhaps one copy of the same email was sent on differentdays to different people), and find out who recipients of documents are,and more. All this information is available and can even be presented asa list or a table for easy comparison between parameters. Yet in someinstances, this information is not required. Therefore, in a furtherembodiment of the present invention, all metadata is hidden from casualview and presented only upon clicking on an icon or similar reference.

In some cases, a reviewer wishes to have access to all body texts andsubject lines, but does not wish to spend time reading anything twice.For example, if the contents of one document are all included within asecond document, the reviewer may prefer to be able to read only theinclusive document. Certain embodiments of the present invention providethat documents are organized and presented according to trees, asdescribed above, enabling the reviewer to selectively read only the leafnode, and he will be assured that he has accessed all the content forthe documents associated with all nodes leading to that leaf.Additionally, a processor may be configured to indicate on a displayunit which nodes are the leaf nodes. For example, leaf nodes may bemarked or highlighted, so that the reviewer should know which to read.Additionally, in response to a user command, the processor can beconfigured to mark nodes for the display unit, in order to indicatewhether a thread has been read, the relevance or priority of the thread,or the level of importance of the thread. The processor may further beconfigured to allow reviewer comments to be added to the display unit.

An additional embodiment of the present invention includes a ‘LeafCompare’ tool—that is, a text comparison tool that compares between thetext of the emails associated with two different nodes, for examplebetween two leaves of the same tree. Using the leaf compare tool, areviewer can access just the differences between two leaves, withouthaving to re-read the content common to both leaves. The text comparetool may be similar to standard document compare tools, or applicationspecific. It preferably enables three different text formats, indicatingdeleted text (that is, text from a first node that does not appear in asecond node), added text (that is, text from a second node that does notappear in a first node), and common text (that is, common text to bothnodes), between two (or more) leaves. Examples of different text formatsinclude but are not limited to, red strikeout text for deleted text,blue underlined text for added text, and plain black text for commontext.

In accordance with a further embodiment of the present invention, thepresentation of the tree may additionally indicate which nodes areassociated with original documents, and which nodes are associated withpresumed documents. For example, nodes associated with only presumeddocuments may be colored a different color, italicized or grayed. In adifferent embodiment, a node that is associated with both a presumeddocument and also an original document will only display an affiliationwith the original document, while the affiliation to the presumeddocument is suppressed from view. In this way, readability is enhanced.

In a further embodiment, the whole tree structure is suppressed fromview (or is not created). In this case, groups of documents that eachcontain a common presumed document are identified. This identificationcan be made using the algorithms disclosed in this disclosure, oranother method. The documents from the group that are the most inclusiveare identified and displayed for review. For the purposes of thisembodiment, the relationship between the other documents does not needto be determined. This is described with reference to FIG. 8 c.

In a further embodiment of the present invention, documents are not onlycompared for equivalence but also for near-duplication. A suggestedalgorithm for determining near duplication may be found in co-pendingapplication: U.S. application Ser. No. 11/572,441, whose contents areincorporated herein by reference. Determining that documents arenear-duplicates of one another, enables near-duplicate documents to bepresented to a reviewer as such. This is very useful for a number ofreasons. Firstly, documents that are near duplicates of one anotherusually refer to the same subject matter, so it is convenient to reviewthem side by side. Secondly, documents that are near-duplicates veryoften actually begin as identical documents, and are changed in minorways, by the user, or, inadvertently, by a computer program. Thirdly,the level of near duplication can be variable by a user, enabling theuser to define how close to each other two documents need to be in orderfor them to qualify as near-duplicates, and for the user to have thempresented together for review. Fourthly, near-duplicates can pick up thesimilarity between two documents when the second document is basicallyidentical to the first, but has had added comments interspersed amongstthe text. For example, in an email reply, sometimes a user adds a wordlike “yes” somewhere in the middle of the body text of the email. Thisadditional word can prevent the two documents—the email reply, and theemail to which it is replying—from being strung together on the sametree. Yet the process steps for near duplication can indicate that therest of the text is basically identical, which can help a reviewerunderstand the relative context of the two emails.

The following represents the use of comparison for near duplication, inaccordance with an embodiment of the present invention. In the processof comparing the documents for duplication, the documents are alsocompared for near-duplication. At least a portion of the body text ofeach document is compared for near-duplication with at least a portionof the body texts of other documents. The comparison enables thedetection and indication of near-duplicated documents. Ifnear-duplication is found, an association is created between thedocuments found to be near-duplicates of one another. In accordance witha further embodiment, nodes that are associated with documents that arenear duplicates to one another are assigned to the same document set.All other nodes in the trees that contain the near-duplicated nodes, aresimilarly assigned to that document set, as will be shown with referenceto FIG. 7 below. In accordance with a further embodiment, a user isenabled to define the degree of similarity between documents for thedocuments to be considered as being closely duplicated.

In accordance with certain embodiments, documents determined to benear-duplicates of one another, are not presented as the same node onthe same tree, but are presented in combination, that is, in closeproximity to one another on a display unit as shown, or otherwiseelectronically linked to one another. The link indicates the fact thatthe two trees each contain a node, that are associated with documentsthat are near-duplicates to one another. For example, a tree has a setof nodes which may be presented on the top section of a computer screen.A document that near-duplicates to any of the nodes of the tree ispresented as an individual node directly below the node to which itnear-duplicates. Sometimes, a document that near-duplicates to adocument in a tree, is itself part of a different tree. In this case,the two trees can be both presented to a reviewer together, and arecalled a ‘document set’. With reference now to FIG. 7, a computerdisplay 50 shows two different trees, each having a root node 73,intermediate nodes 74, and leaf nodes 75. Each of the two trees containsa node that is associated with documents that near-duplicate to oneanother. The two nodes that are associated with the near-duplicatedocuments are marked ND. The trees that have nodes that are associatedwith near-duplicate documents are displayed together to a reviewer, asfor example, is shown in FIG. 7, in which the two trees are presented onthe computer display 50 simultaneously. The two trees in thisnon-limiting example are presented one above the other, separated byseparating line 52, to indicate that the nodes displayed are not allpart of the same tree, but that the displayed trees are related to oneanother, and part of a single document set. A document set consists oftwo or more related trees or nodes.

Document sets are another example of data structure. Document sets maybe sets of nodes or sets of documents according to their associationwith nodes. In accordance with an embodiment of the invention, a methodfor marking the documents as associated with a certain document set isas follows: a first document is associated with a document set; alldocuments that are associated with a node that is linked to the nodeassociated with the first document (or another previously addeddocument) are then also associated with the document set. All documentsthat near-duplicate to a document already in the document set are alsoassociated with the document set.

In the present example, the related trees are connected by the fact thatone or more nodes near-duplicate to each other between the two trees.The two trees are displayed in close proximity to one another. This isjust one specific way of indicating that the nodes associated with nearduplicate documents are affiliated with one another. This is only oneform of representing the relationship between near duplicatesand thereare many other acceptable ways to represent them, considered within thescope of the present invention.

In a further embodiment of the present invention other forms of documentsets are described, enabling two or more trees to be affiliated with oneanother, indicating that they probably contain related subject matter.In a case where the documents are emails, there are email programs thatstore message identifiers to identify individual emails with a string ofcharacters. When a user presses Reply-to, or Forward, in order toconstruct his email based on a previous email, these email programscreate the message identifier for the new email to include a referenceto the previous email. By parsing the message identifier, it is possibleto determine which emails are replies or forwarding of which otheremails. These emails are likely to be related to one another, so suchemails are grouped together in a document set. In other words, emailswhose Message ID indicate that they are connected to one another are notstrung together on the same tree, but the trees in which each of themare nestled are presented together on the screen.

In a further embodiment of the present invention, document sets areconstructed based upon a Conversation ID. Conversation ID is a featureof Microsoft Outlook, and is similar to the Message identifier describedin the previous paragraph. Basically a Conversation ID contains a stringof characters identifying an email. The basic character string for a newemail may be 44 bytes long. When a person replies to, or forwards theemail, an additional 10 bytes are added to the 44 byte string. Thus itis easy to see which emails are replies to other ones. Documentsidentified as being related to one another based upon Conversation IDare presented as document sets. The fact that their subject matter islikely to be related is indicated to the reviewer by the presentation oftwo or more trees in close proximity, or linked to one another. Inaccordance with one embodiment, a method for the invention includescreating an association between nodes that are associated with documentshaving related Conversation ID or Message ID indicators. The documentsmay be displayed grouped according to document sets.

The above description describes the use of trees and nodes inrepresenting duplicating documents, parent-child relationships, and nearduplicates. The following description relates to different types oftrees. In FIG. 8a , a (prior art) tree of documents is shown, such asmay be created with the Prior Art of constructing a tree solely usingConversation ID Trees, of Microsoft Outlook. The tree is created for anoccurrence known as Scenario 1, as follows. Scenario 1 represents thefollowing exchange of emails. Document a is a first email sent by asender to three recipients. Documents b, d, and f, are three identicalreplies from the three recipients. This can happen for example if thesender had asked them to respond with a “yes” or a “no”. Variousmetadata fields such as the “from:” field parameter, are differentbetween the three identical, or duplicate, emails b, d and f, yet thebody texts are substantially identical. Documents c and e are twodifferent, responsive, further replies, from the sender to two of thethree recipients. All of these documents have been extracted from thesender's email program, and arranged into a tree.

As may be seen in FIG. 8a , each email is associated with a different“node”, or icon on the tree, since these icons by definition for thisprior art only contain one document. There are therefore six nodes, oricons, on the tree, namely 851-856, showing the exchange. For purposesof simplicity, it has been assumed in Scenario 1 that the subject linewas not changed during the exchange of emails, and that only the emailsfrom the sender's computer are available. Note that even if there wouldhave been a thousand different email replies instead of just three (b,d, and f), the tree would have had been massive to accommodate thethousand different nodes, or icons, one per document.

In FIG. 8b , a tree of nodes according to certain embodiments of thepresent invention is shown. The same documents from Scenario 1 areorganized, but this time the tree need only contains four nodes, namely(861-864), associated with the four different emails. Node 861 isassociated with document a, Node 862 is associated with documents b, d,and f, Node 863 is associated with document c, and Node 864 isassociated with document e. The tree of Figure Ab is significantly morecompact than that of Figure Aa, since it contains fewer nodes. Thisreduces the representational space on the display that is required, andalso slashes review time for a reviewer.

In FIG. 8c , a tree having only a trunk and leaf nodes, according to adifferent embodiment of the present invention, is shown. As mentionedabove, according to certain embodiments, another output of the presentinvention is when all documents containing the same included documentare identified as a subgroup. From this subgroup of documents, thedocuments that are most relevant may be the inclusive documents. Theseare therefore associated with leaf nodes on a tree. In the trunked tree,as shown in FIG. 8c , all the non-inclusive documents are not displayedas nodes, but are all grouped together into the trunk. A tableaffiliating the documents and their header parameters may certainly beprovided. The only nodes that need be shown for the trunked tree are theleaf nodes. In FIG. 8c , the same documents from Scenario 1 areorganized, but this time, there is only one trunk 871 and two leaf nodes872-873. The trunked tree may be built according to a method describedabove for building nodes and trees, while not differentiating betweennodes except leaf nodes, or using another method entirely. The trunkedtree can have associated with the trunk a number of documents havingdifferent subject parameters, so long as all include the same includeddocument (whether original or presumed). It has been described above thecharacteristics that determine whether a document is considered includedwithin the body text of another.

According to this embodiment, the data structure comprises one or moretrees, in which a tree comprises at least a trunk and at least one node.Each node is associated with a document, and the trunk is associatedwith (zero or more) documents. All documents whose body text includesthe same included document are associated with the same tree, and eachunique inclusive document, as well as documents that duplicate to thisunique inclusive document, is associated with one of the nodes of thetree. Each included document, as well as documents that duplicate toincluded document, are associated with the trunk of the tree.

One method for producing the trunked tree is using the embodimentsdescribed above with respect to FIGS. 3-6. When the tree is built, anynodes that are associated with documents that match presumed documents,or are associated directly with presumed documents, are associated witha trunk 871—these are the documents for which a more inclusive documentexists. According to an embodiment of the invention, the trunk issuppressed from view, or, alternatively, it is displayed.

In one embodiment, in order to preserve header parameters associatedwith parent nodes, the header parameters of all the documents associatedwith the trunk are associated with the leaf nodes. In other words, if adocument associated with the node has had a presumed documentconstructed from it, one can additionally affiliate header parametersfrom all the documents that matched the presumed documents with thenode. This is because the nodes associated with the presumed documentshave been suppressed from display.

In accordance with a further embodiment of the present invention,another form for outputting documents, that have been arranged accordingto inclusiveness, is provided, as opposed to presenting them as trees.The trunk or the nodes may be displayed with one of many forms of treesymbolism; yet display alternatives also exist, as will be shown.Documents associated with the trunk or the node are identified as beinggrouped according to their association with the trunk or tree, but donot have to be presented in terms of the group.

As shown in FIG. 8d , according to this embodiment, a subset ofdocuments from the original group of documents is presented. Thedocuments are not necessarily displayed in their entirety; they may justbe provided as a list, as shown in the first column of FIG. 8d . Thesubset includes only a single copy of the inclusive documents, that is,Documents c and e. In other words, the subset includes all the originaldocuments, except those documents that are duplicate of a presumeddocument, and it also excludes all presumed documents. In accordancewith one embodiment, the documents that do not exhibit in the subset(i.e., they are suppressed) are nevertheless available for a reviewer tosee, if such is desired. For example, these non-exhibiting documents canbe affiliated with the documents of the subset to which they duplicate,or from which a presumed document to which they duplicate is derived orconstructed. Or, according to another embodiment, all the nodes aredisplayed in a subset, while nodes associated with presumed documentsare suppressed from the subset display. In this way, all includedemails, (these are the documents that are associated with presumeddocuments) are not shown in the subset display. In a further embodiment,header parameters for each document associated with a displayed node ofthe subset are shown in a data table of the node. Header parameters foreach document associated with a suppressed node from the subset are alsoshown in the data table of the displayed node of the tree. The displayednode with which the data table of suppressed nodes is associated is thenode that is associated with the document from which the presumeddocument associated with the suppressed node is constructed, i.e. theinclusive node.

In another example, shown in FIG. 8d , a further column is added,listing and linking (affiliating) all the included documents with theinclusive document that they are included in. According to furtherembodiments of the invention, other details are added to the list ofinclusive documents, for example, an indicator that one of the documentshad an attachment. According to a further embodiment of the invention,if a duplicate to an inclusive documents exists, this duplicate would belisted in the same cell as the inclusive to which it duplicates. Forexample, the cell entry might be “c,h,”, in which h is a duplicate to c,an inclusive document. According to an embodiment therefore, a processoris configured to display the documents as a list of grouped entries, inwhich each grouped entry includes the documents associated with a leafnode, a leaf node being a node that has no descendant nodes. Thesedocuments are the inclusives. The documents can be referred to withtheir numeric identifiers. In a further embodiment, each grouped entryfurther includes a listing of the documents associated with nodes ofwhich said leaf node is a descendant.

In accordance with another embodiment of the present invention, anotherform for outputting documents, that have been arranged according toinclusiveness, is provided, as opposed to presenting them as graphicaltrees. For example, documents may simply be listed in the data structurein sequential order and be supplied with a column listing indicatingwith which tree, and with which section of the tree, they areassociated. As shown in the first column of FIG. 8e , all the documentsof the original group are listed in a data structure, for example in afirst column. A notification is provided in the third column, adjacentto the list, to indicate which documents are the inclusive documents. Inaccordance with another embodiment, and as shown in the second column ofFIG. 8e , further indication indicates the position a node for thedocument would assume if it were to be displayed upon a tree. Forexample, the node address for document b, d and f, is 10:10:11. They allhave the same node address because they are duplicating documents. Thenode address indicates that they feature in Tree 10, in Thread 10, andin Position 11. These numerical values for tree, thread and positionneed not necessarily start with 1, for example, Thread 10 may be thefirst thread of the tree. According to a further embodiment, anotherparameter can be added to the address, to indicate which document setthe tree belongs to. According to certain embodiments the columns can besorted by a user, for example, if the data structure is in the form of aspreadsheet, they may be able to be sorted according to one of more ofthe following criteria: document identifier, document sets, numeric nodeaddress, an inclusive flag, and also, a ‘first copy of an inclusiveflag’. This latter flag would direct a reviewer to read only one(arbitrary) copy of the inclusive.

In another example, the columns could represent trunked trees as shownin FIG. 8c , and the address column would indicate the tree to which thedocument is associated and whether it is associated with a root node orthe trunk. These examples are only intended for exemplary purposes, anddo not seek to limit the number of ways that numerical or writtenindicators are able to describe the arrangement of a document relativeto others, arranged according to duplication and inclusiveness.

There have been described above, many non-limiting different ways inwhich documents can be arranged according to duplication, inclusiveness,and, according to certain embodiments, according to document sets. Thefollowing seeks to describe document properties and document sourcesthat can be used in accordance with embodiments of the invention.

Another benefit of an embodiment of the present invention is its abilityto have access to files such as emails from different computers, or fromdifferent email archives, for example different PST files. According tocertain embodiments, the operation of the invention is not toimmediately assign documents extracted from different bulk files todifferent trees, but rather assigns documents to trees according toinclusiveness, irrespective of which file the document originated from.Thus a tree may be composed of documents originating from a number ofdifferent trees. According to further embodiments, it is also irrelevantwhether the documents were in whole document format or needed extractionto document format before the invention is applied. Similarly, theinvention is not limited to only associating documents with nodes on thesame tree if the subject parameter for all the documents is the same. Onthe contrary, for different nodes, the subject parameter may bedifferent, but as long as the documents satisfy the inclusivenesscondition, they may be associated with nodes of the same tree.

FIG. 9 shows 2 computers, 130 and 132, from which many documents are tobe extracted and organized. For example, each computer contains a PSTfile, 134, 136. Each PST file contains, or has available for extraction,many email documents, or emails for short. Array 138 shows how thesefiles can theoretically be stored all together, irrespective of whichPST they are extracted from. In certain embodiments, array 138 isincluded. In other embodiments, the array does not need to exist,although the documents may still be extracted from multiple sources.Tree 140 shows how the files from array 138, originating from each ofthe computers, are together organized as a tree or trees, according totheir degree of inclusiveness. Tree 140 includes one or more nodes, eachnode associated with one or more documents, for example emails.

As mentioned before, according to certain embodiments, a node can evenbe associated with a “presumed document”—or a “presumed email”—andocument that has not been extracted from either of the PSTs 134 or 136,but is nevertheless presumed to have existed once, since a header forit, and text, is included within the text of a document that is found inone of the PSTs.

As mentioned, Tree 140 includes a number of nodes 142, and each node isassociated with one or more documents. Each document is associated withits own node, unless the document duplicates to another document. If thedocument is a duplicate of another document, both of them are associatedwith the same node. Each node forms its own tree, unless it is adescendant of a different node. From the contents of more than one PST,it is expected that a high number of different trees will be used toorganize the documents. A node belongs to a tree if it is a descendantof another node in the tree.

It will also be understood that the system according to the inventionmay be a suitably programmed computer. Likewise, the inventioncontemplates a computer program being readable by a computer forexecuting the method of the invention. The invention furthercontemplates a machine-readable memory tangibly embodying a program ofinstructions executable by the machine for executing the method of theinvention.

Many specificities have been provided in the above description, however,these should not be construed as limiting the invention in any way. Inaddition, certain details have not been described, as they would beobvious to persons skilled in the art.

The invention should be understood in terms of the appended claims.

The invention claimed is:
 1. A computer implemented method fororganizing documents into nodes, in which a node represents a group ofnear equivalent documents, said computer implemented method comprising:(i) providing a plurality of original documents, each of the originaldocuments comprising a header and a body text, wherein said headercomprises at least one header parameter and said body text comprisestext; (ii) selecting a document from among said plurality of originaldocuments and associating the selected document with a node; removing atleast one member of a group consisting of: disclaimers, signatures,program added text and attachment notifications, from the body text ofthe selected document, replacing unique text of each removed member witha unique short text identifier; (iii) comparing a fingerprint of saidselected document after said replacing to previously stored fingerprintsof other documents from amongst said plurality of original documents,and in the case of a match between the fingerprints, merging the nodeassociated with said selected document with a node associated with amatching document having a fingerprint matching the fingerprint of saidselected document; (iv) searching in text order through said body textof said selected document to locate a first instance of header-type textwithin said selected document, wherein said header-type text contains atleast one header parameter; (v) constructing a presumed document from asubset of the body text of said selected document, the constructedpresumed document having (a) a header that includes one or moreparameters from said header-type text located within said body text ofsaid selected document, irrespective of whether the subject parameter ofthe header of said presumed document is the same as the subjectparameter of the header of said selected document, and (b) body textthat includes the text of said selected document located after saidheader-type text in said body of said selected document, and associatingsaid presumed document with a node; (vi) comparing a fingerprint of saidpresumed document to a previously stored fingerprint of at least oneother document from among said plurality of original documents and inthe case of a match between the fingerprints, merging a node associatedwith said presumed document with a node associated with a matchingdocument having a fingerprint matching the fingerprint of said presumeddocument; and (vii) if the comparing of (vi) does not result in a match,processing repeatedly a remainder of the body text of said selecteddocument for successive instances of header-type text according to step(iv), and for each successive instance of the header-type text,constructing a corresponding presumed document according to step (v),and comparing for any matching documents to the corresponding presumeddocument according to step (vi), said processing of steeps (iv)-(vi) isrepeatedly performed until a match is found in step (vi) or until no newinstances of header-type text are found in step (iv), wherein eachfingerprint comprises a representation of a corresponding document. 2.The computer implemented method of claim 1, further comprising: (viii)storing the document fingerprint for future comparison with otherdocument fingerprints.
 3. The computer implemented method of claim 2,further comprising: displaying on a display unit symbols indicative ofsaid nodes, and affiliating for each node a bod text and subjectparameter of at least one document associated with the node.
 4. Thecomputer implemented method of claim 3, further comprising: affiliatingeach node with a plurality of header parameters from each documentassociated with the node, said plurality of header parameters beingarranged in a table.
 5. The computer implemented method of claim 4,wherein said documents are emails and wherein said plurality of headerparameters comprises two or more fields from an email header selectedfrom the group of fields consisting of: “To”, “From”, “Subject”, and“Date”.
 6. The computer implemented method of claim 2, furthercomprising: displaying the nodes; and suppressing nodes associated witha presumed document from the display.
 7. The computer implemented methodof claim 6, further comprising: affiliating each displayed node withheader parameters of each document associated with said displayed node;and affiliating header parameters of documents associated suppressednodes with a node associated with a document from which the presumeddocument associated with said suppressed node is constructed.
 8. Thecomputer implemented method of claim 2, wherein (ii) further comprisescomparing for near-duplication at least a portion of the body text ofsaid selected document to at least a portion of the body texts of otherdocuments from amongst said plurality of documents.
 9. The computerimplemented method of claim 8, further comprising: creating anassociation between nodes that are associated with documents found tonear-duplicate to each other.
 10. The computer implemented method ofclaim 9, further comprising: enabling a user to define a degree ofsimilarity between documents for documents to be considerednear-duplicating.
 11. The computer implemented method of claim 8,further comprising: associating documents with document sets byassociating to a document set: a first document, and documents that areassociated with a node that is linked to the node associated with saidfirst document already associated with said document set, and documentsthat near-duplicate to a document already associated with said documentset.
 12. The computer implemented method of claim 2, further comprising:creating an association between nodes that are associated with documentshaving related Conversation ID or related Message ID indicators.
 13. Thecomputer implemented method of claim 2, further comprising: displayingdocuments in a data structure able to be sorted according to one or moremembers of the group consisting of: document identifier, document set,node address, inclusive flag, first copy of an inclusive flag.
 14. Thecomputer implemented method of claim 2, further comprising: (ix) if adocument is found to be a duplicate of a prior document, suppressingstep (viii).
 15. The computer implemented method of claim 14, furthercomprising: (x) forming a subset of a large number of documents byincluding each document into the subset except for documents thatduplicate to another document already in the subset, and except fordocuments that duplicate to a presumed document whereby only a singlecopy of inclusive documents are in the subset.
 16. The computerimplemented method of claim 1, wherein (ii) is applied to selecteddocuments from amongst said plurality of original documents.
 17. Thecomputer implemented method of claim 1, wherein said (ii) furtherincludes creating a fingerprint for each of at least a portion of anormalized body text and a normalized subject parameter of said selecteddocument, said normalized body text and said normalized subjectparameter are processed from said body text and a subject parameter ofsaid header parameters, said (iii) includes comparing the createdfingerprint of said selected document to previously stored createdfingerprints of other documents from amongst said plurality ofdocuments, and in the case of a match, merging the node associated withsaid selected document with a node associated with the matchingdocument, wherein said comparison for detecting and indicatingduplicating documents; and said (vi) includes creating a fingerprint foreach of at least a portion of the normalized body text and thenormalized subject parameter of said presumed document and comparing thecreated fingerprint of said presumed document to a previously storedcreated fingerprint of at least one other document from among saidplurality of documents and in the case of a match, merging a nodeassociated with said presumed document with a node associated with thematching document.
 18. The computer implemented method for organizingdocuments of claim 17, further comprising a step of linking nodes, inwhich linking implies that the normalized body text of a document on afirst side of said link is inclusive of the normalized body text of adocument on a second side of said link, and wherein (vi) furthercomprises linking the associated node to be a parent of the nodestipulated in (iii); and wherein (vii) comprises linking the associatednode to be a parent of the associated node of the most recent iterationof (vi).
 19. The computer implemented method of claim 1, wherein said(vii) includes: for each of said instances, constructing saidcorresponding presumed document irrespective of whether the subjectparameter of the header of said corresponding presumed document is thesame as the subject parameter of the header of said original selecteddocument or of previous constructed presumed document.